Firewall Pass rule to access HAProxy
-
Hi all,
I have a small business network with multiple VLAN's. I run HAProxy as a reverse proxy to provide (local and public) access to a couple of servers. Those servers run on a secure VLAN.
One of the other VLAN's, the "Office Computers" VLAN, has always had unlimited access to both the pfsense firewall and the Servers VLAN, via Pass All - All rules. This simplifies management. However clients such as phones and laptops may carry viruses and malware, so I want to tighten the security a bit:- restrict clients that need access to the servers
- restrict unnecessary access to pfsense
So I started by disabling the Pass All - All rules for VLAN "Office Computers" and added a new Pass rule to exclude Local RFC1918 Networks, so basically clients on that VLAN can only reach internet, no local sources.
Then I selected some clients and created a Pass rule for them to one of the servers (which is a backend in HAProxy). The clients can now directly access that server, but they cannot access pfsense, hence the HAProxy route doesn't work.So now I am looking for a way to compose a Pass rule to grant these clients access to HAProxy. However, I am hesitant to simply allow full access to pfsense, as this would kind of set me back to where I started: Full access to servers and pfsense, albeit that it's just for a subset of clients.
Mind you: I have over 50 clients in the "Office Computers" subnet that I want to grant access to one particular server, a Synology NAS that provides Synology Drive, Photos and shared folders. These are laptop computers, mobile phones and the occasional smart watch. So that is basically the entire VLAN, which I wanted to shield off from pfsense and the servers as much as possible.
So the question is basically how to make the HAProxy frontends and backends work without opening up my entire pfsense box to 50 clients.
I hope this makes sense.
-
@Cabledude well what port does haproxy listening? Allow that port and what IP, the wan IP the lan IP? Create a rule to allow that traffic.
-
@johnpoz said in Firewall Pass rule to access HAProxy:
@Cabledude well what port does haproxy listening? Allow that port and what IP, the wan IP the lan IP? Create a rule to allow that traffic.
Hi John,
Thank you very much for your time.For local frontends HAProxy is listening on port 443. I have a certificate in use for HAProxy that was created by Acme service on the same unit. In DNS Resolver I created host overrides for every service, to the IPv4 address of the Netgate.
So I could create Pass rules from only the 50 clients in VLAN "Office Computers" to the Netgate IPv4 on port 443.
The questions now are:
#1 will constraining the FW rule to only allow port 443 provide any security benefits over granting access to the Netgate on any port?
#2 Are there even any ports open on a pfSense box that could provide a way in? A sockstat shows ports 53, 67, 80, 123, 443, 953. Add a custom port for the webconfigurator. And the admin account has been disabled and my own user password is very strong. -
@Cabledude I assume your 80 and 443 are your haproxy. 53 is dns, 67 is dhcp, 123 is ntp. 953 is control of for bind normally - are you running bind and not unbound?
Why would you allow all - but I am not aware of any exploit to those service that would give control of the firewall - also are you worried about clients on your own network hacking into your firewall?
Do you have pfsense setup for https - you can turn off listening on 80 then, its just a redirect to the ssl port. I run mine on 8443.
Are you specifically blocking 443 to pfsense IPs - I mean 443 is normally open to anything because kind of requirement to use the internet :)
-
@johnpoz thank you for your insights. What I am trying to accomplish here is part of a major overhaul of my VLAN’s, rules and unifi port configuration (infrastructure vs edge).
For years I have fenced off IoT devices, cameras and guests by using the VLAN’s. But the actual users of my network have always had full access to everything, which is convenient and practical to make things work.
I trust my users not to hack into my network willingly. But I don’t have much knowledge of malware and other threats and how they could find a way into pfSense. I just know that they exist and that I don’t control any bad internet habits of the users of my network. Hence the idea that I would do best locking down the management side of my network from the Office Computers VLAN. And only provide the minimum access required for the functionality we need.
I built HAProxy to simplify client side configuration of Synology apps, so to access via the same FQDN being Local or Public.
My users only need those resources, so I am looking for the minimum set of firewall rules to make this work.Hope this explains what I am trying to do. I am a civil engineer, I know about concrete and steel to make bridges and other structures, I’ve never had IT training.
-
@Cabledude said in Firewall Pass rule to access HAProxy:
Synology apps, so to access via the same FQDN being Local or Public.
I would do that with just a split dns.. Clients pointing to pfsense for dns - dns would just have a host record for say nas.publicdomain.tld that points to the local IP.. While clients out on the internet using nas.publicdomain.tld would get your public IP.
-
@johnpoz Well yes, split DNS can work. However I have about 5-8 services that I wish to make available by FQDN, 5 public and 8 local, with certificates. I can use a wildcard certificate created by Acme to secure all services. With split DNS I wouldn't know how to manage https connections and allow for more than one public service.
-
@Cabledude yeah the reverse proxy makes it easy for the ssl offload for sure. Use it myself for that reason.
Privacy Policy · Cookie Policy